PaperlayerView exact revision on arXiv

Source-linked AI summary

PrinGS: Privacy Preservation in Gaussian Splatting

Gaurav Behera, Abhinav Raundhal, Archisha Panda, Saumya Balina, Gargi Shroff, Ponnurangam Kumaraguru

arXiv:2610.36168v1cs.CV

TL;DR

Shared 3D Gaussian splats can expose sensitive visual information from arbitrary viewpoints, and anonymizing existing splats is challenging when retraining or source images are unavailable. PrinGS edits sensitive regions in the learned representation after training and extends the approach to privacy-by-design training. It reports low facial similarity while retaining face detection and makes sensitive text unreadable under OCR evaluation.

  • Problem

    Sensitive information embedded in shared 3D splats can remain accessible from arbitrary viewpoints, while anonymizing existing splats is needed when retraining is infeasible or source images are unavailable.

    Source: §1 · p. 1

  • Method

    PrinGS localizes sensitive Gaussians from user-provided views and anonymizes the representation, with an extension that integrates anonymization into training.

    Source: §1 · p. 2

  • Results

    FSM reaches 9.79% with FDR at 39.47%, while textual OCR CER reaches 1.00 versus baseline 0.208.

    Source: §1 · p. 2, §4.5 · p. 7

  • Takeaways & Limitations

    PrinGS-Humans and privacy-specific metrics support systematic evaluation of face and text privacy in Gaussian Splatting.

    Source: §1 · p. 2

    Retrospective edits may leave traces of private information when sensitive Gaussians are deeply entangled with scene structure.

    Source: §3.4 · p. 5

Abstract

from arXiv · show

3D Gaussian Splatting (3DGS) has rapidly become the preferred representation for high-fidelity novel view synthesis and 3D scene reconstruction. However, the learned representation encodes sensitive visual information including human faces, license plates, documents, and computer screens, raising significant privacy concerns when trained splats are shared or deployed. In this work, we address the underexplored problem of privacy preservation in Gaussian Splatting by proposing a representation-level anonymization framework that directly anonymizes a trained splat. Given a trained splat and a user-provided reference view identifying sensitive content, our method localizes the corresponding regions in the underlying 3D representation and directly anonymizes them, ensuring that the sensitive information is absent from all subsequently rendered novel views while preserving the overall scene geometry and visual fidelity. We achieve this post-training anonymization in less than 1 second. Furthermore, we extend our framework with a privacy-by-design training strategy that prevents sensitive content from being embedded into the representation during optimization, enabling the generation of privacy-preserving splats directly from training images. Our method achieves a remarkably low Face Similarity Measure (FSM) of 9.79% at a retained Face Detection Rate (FDR) of 39.47% and makes sensitive text completely unreadable with an OCR Character Error Rate of 1.00. Our work aims to serve as the primary stepping stone towards privacy-aware 3D representations and motivates further research along these directions.

1 Introduction

Shared 3D Gaussian splats can expose private information from arbitrary viewpoints, while removing it from existing splats is difficult when retraining or source images are unavailable. PrinGS anonymizes the learned representation after training and extends this approach to training, with a new benchmark and privacy-specific evaluation metrics.

Motivation

  • Sensitive information embedded in shared 3D splats can remain accessible from arbitrary viewpoints, raising privacy and regulatory concerns.Retraining may be infeasible, and original training images may be unavailable or costly to reacquire.Source: §1 · pp. 1–2

Post-training anonymization

  • PrinGS localizes sensitive Gaussians from user-selected reference views and anonymizes the representation, targeting leakage across novel viewpoints while preserving scene geometry and fidelity.Unlike image-space edits, the method acts directly on the trained splat and does not require the original training images.Source: §1 · p. 2

Privacy-by-design

  • The privacy-by-design extension integrates representation-level anonymization into optimization to prevent sensitive information from being encoded during training.Source: §1 · p. 2

Benchmark

  • PrinGS-Humans provides synthetic indoor scenes with nine human subjects across skin tones and genders for systematic evaluation of face privacy in Gaussian Splatting.Source: §1 · p. 2

Results

  • FSM reaches 9.79%, a 74.08% reduction from standard 3DGS at 83.87%, while textual OCR CER reaches 1.00 versus the baseline 0.208.The reported metrics assess facial similarity and textual readability, respectively.Source: §1 · p. 2

Framework and evaluation

  • The contribution summary reports that post-training anonymization takes 1 second and introduces FSM, FDR, and OCR CER as privacy-focused evaluation metrics.Source: §1 · p. 2

2 Related Work

Prior 3DGS work largely emphasizes rendering quality and efficiency, while privacy methods are concentrated in 2D images and video. For 3D scenes, anonymization must remain consistent across viewpoints without sacrificing useful scene content, and image-space preprocessing can disrupt reconstruction.

2.1 3D Gaussian Splatting

  • 3DGS research has advanced rendering quality and efficiency, including semantic attributes that require training, while PrinGS localizes sensitive Gaussians directly from rasterizer contributions.The related work describes 3DGS as an explicit Gaussian representation that supports real-time rendering.Source: §2.1 · p. 2

2.2 Privacy Preservation in 2D Visual Data

  • 2D image anonymization typically detects or segments sensitive regions and then blurs, masks, pixelates, or scrambles them; video methods add temporal tracking.Source: §2.2 · p. 3

2.3 Privacy Preservation in 3D Scenes

  • 3D privacy requires anonymization across arbitrary viewpoints while retaining useful human presence, but image-space masking can degrade SfM matching and make per-view appearances inconsistent during optimization.PrinGS instead formalizes representation-level anonymization intended to preserve scene geometry and rendering quality.Source: §2.3 · p. 3

3 Methodology

PrinGS identifies sensitive Gaussians in 3D, applies content-specific anonymization, and supports both post-training edits and privacy-by-design training.

3 Methodology

  • The methodology combines 3D sensitive-Gaussian segmentation, localized anonymization operators, post-training editing, and privacy-by-design optimization.The framework overview distinguishes anonymizing an existing splat from preventing sensitive content from being encoded during optimization.Source: §3 · p. 3, Figure 2 · p. 4

3.1 3D Segmentation of Sensitive Gaussians

  • Single-view segmentation flags Gaussians whose sensitive-mask contributions exceed their non-sensitive contributions, then rejects spatial outliers; multi-view aggregation selects Gaussians meeting a global visibility threshold.The segmentation tracks transmittance-weighted contributions during rasterization; multi-view counts accumulate across views.Source: §3.1 · pp. 3–4

3.2 Gaussian Anonymization Formulation

  • Text anonymization blends both spherical-harmonic appearance and spatial means uniformly, dissolving character color and physical shape.For faces, only appearance coefficients are blended, with scale-dependent weights that preserve spatial geometry while removing identifying details.Source: §3.2 · p. 4

3.3 Post-Training Privacy Preservation

  • Post-training anonymization takes a trained splat, one reference view, and its binary privacy mask, then edits the representation so sensitive information is erased across novel views.Face regions receive scale-weighted appearance blurring; text receives uniform appearance and structural blurring.Source: §3.3 · p. 5

3.4 Privacy-by-Design

  • For privacy-by-design, face anonymization follows geometry convergence, while text regions are excluded from photometric loss and periodically structurally anonymized during training.The text procedure uses masked non-sensitive regions in the loss and applies multi-view text segmentation with uniform structural anonymization.Source: §3.4 · p. 5

4 Results and Experiments

The experiments evaluate PrinGS in post-training privacy preservation and privacy-by-design settings against standard 3D Gaussian Splatting.

  • The evaluation compares PrinGS in post-training and privacy-by-design settings with standard 3D Gaussian Splatting, using qualitative and quantitative privacy assessments.Source: §4 · p. 5

4.1 Experimental Setup

Experiments use a single RTX 3090 Ti and reserve every eighth frame for evaluation.

4.1 Experimental Setup

  • Every eighth frame is reserved for evaluation, with the remaining frames used for optimization on a single NVIDIA RTX 3090 Ti GPU with 24 GB VRAM.Source: §4.1 · p. 5

4.2 Datasets

The evaluations use a synthetic human-face benchmark and existing public scenes containing readable text.

4.2.1 PrinGS-Humans Dataset.

  • The synthetic PrinGS-Humans benchmark contains two indoor scenes and nine unique subjects with varied appearances, including skin tones, ages, genders, hairstyles, and facial hair.Source: §4.2.1 · p. 5

4.2.2 Text Privacy Dataset.

  • Text privacy is evaluated on five public-benchmark scenes containing varied readable text, including number plates, house numbers, and brand names across fonts, colors, orientations, and viewing distances.The scenes comprise Truck, Barn, and M60 from Tanks and Temples, plus Car and Piano from DL3DV-10K.Source: §4.2.2 · pp. 5–6

4.3 Evaluation Protocol

The evaluation covers post-training anonymization of existing splats and privacy-by-design training from input images. It assesses rendered views qualitatively, with ground-truth images also enabling quantitative evaluation for privacy-by-design.

4.3.1 Post-training Anonymization.

  • The post-training setting assumes only a trained splat is available; a user marks sensitive content in a reference view, which is segmented before corresponding Gaussians are anonymized.The modification is made directly in the representation, so anonymization propagates to rendered viewpoints.Source: §4.3.1 · p. 6
  • Qualitative post-training results span multiple scenes and viewpoints, with controlled quantitative evaluation reported in the supplement.Source: §4.3.1 · p. 6

4.3.2 Privacy-by-Design.

  • For privacy-by-design, input-image masks of sensitive regions guide optimization; Figure 5 compares ground truth, standard 3DGS, and PrinGS, while ground truth also permits quantitative evaluation.The comparison covers scenes from DL3DV-10K, Tanks and Temples, and PrinGS-Humans; the caption reports sensitive content prevented from encoding while non-sensitive appearance is preserved.Source: §4.3.2 · pp. 6–7, Figure 5 · p. 7

4.4 Evaluation Metrics

The evaluation uses task-specific measures for privacy alongside conventional rendering-fidelity metrics. Face similarity, face detectability, and text readability are assessed separately.

4.4 Evaluation Metrics

  • Three task-specific measures—FSM, FDR, and OCR Character Error Rate—address privacy, which conventional rendering-fidelity metrics such as PSNR, SSIM, and LPIPS do not quantify.Source: §4.4 · p. 7

4.4.1 Face Similarity Measure (FSM).

  • FSM is cosine similarity between ground-truth and anonymized face embeddings extracted from rendered views; lower similarity indicates more successful anonymization.The pipeline uses InsightFace, SCRFD-10GF face detection, and ArcFace embeddings.Source: §4.4.1 · p. 7

4.4.2 Face Detection Rate (FDR).

  • FDR reports the fraction of ground-truth faces still detectable in anonymized renders, complementing FSM because an undetected face receives zero similarity.Source: §4.4.2 · p. 7

4.4.3 OCR Character Error Rate (CER).

  • OCR-CER measures text readability using recall-based character error from Levenshtein distance; higher error indicates that textual geometry has been destroyed.Source: §4.4.3 · p. 7

4.5 Privacy-by-Design Results

Privacy-by-design suppresses facial identity features and readable text while retaining scene content. The reported results cover facial metrics, OCR, and qualitative novel-view renderings.

4.5 Privacy-by-Design Results

  • Qualitative comparisons report removal of sensitive facial and textual information while maintaining high rendering quality for remaining scene content.The evaluation summary states that facial and textual information are masked across arbitrary novel viewpoints.Source: §4.5 · pp. 7–8
  • 9.79% overall FSM with 39.47% FDR: anonymized faces remain detectable, but the recognizer can no longer match them to the correct identity.Standard 3DGS has 94.74% FDR, indicating faces are present and identifiable; the reported FDR also reflects retained facial geometry.Source: §4.5 · pp. 7–8
  • 1.00 recall-based CER versus standard 3DGS’s average CER of 0.208 across five scenes, indicating complete disruption of text recognition.Source: §4.5 · p. 8, Table 2 · p. 8

4.6 Ablation Studies

The ablations examine post-training runtime and how neighborhood size and anonymization iterations affect FSM. Increasing both improves privacy results until gains saturate.

4.6.1 Runtime Analysis.

  • Post-training anonymization takes less than 1 second, with runtime analysis reporting scene and anonymization parameters alongside runtime.Source: §4.6.1 · p. 8, Table 3 · p. 8

4.6.2 Neighborhood size (k) and Number of Anonymization Iterations (t).

  • The ablation varies neighborhood size k and anonymization iterations t, evaluating their effects on FSM.Each sensitive Gaussian is updated using information aggregated from neighboring Gaussians.Source: §4.6.1 · p. 8
  • On the House dataset, larger neighborhoods and more anonymization iterations lower FSM, with gains eventually saturating.After saturation, further increases can serve as a control for visual aesthetics, balancing local color retention against more uniform blending.Source: §4.6.1 · p. 8, Figure 6 · p. 8

5 Conclusion

PrinGS directly anonymizes learned Gaussian representations, supporting both post-training edits without original training images and privacy-by-design optimization. The authors report sensitive information removed across novel viewpoints while preserving the remaining scene’s visual fidelity.

5 Conclusion

  • PrinGS removes sensitive information across novel viewpoints while preserving the remaining scene’s visual fidelity.The conclusion reports qualitative evaluation of post-training anonymization alongside task-specific facial and textual privacy metrics.Source: §5 · p. 8
  • The framework edits learned Gaussians, enabling post-training anonymization without original training images or retraining.The same formulation extends to privacy-by-design during Gaussian Splat optimization.Source: §5 · p. 8
  • The authors introduced benchmarks for facial and textual privacy, evaluated with face re-identification similarity and OCR Character Error Rate.The evaluation also includes qualitative assessment of post-training anonymization.Source: §5 · p. 8
  • The authors frame their work as a step toward practical privacy-aware 3D representations and call for further methods, benchmarks, and evaluation protocols.Source: §5 · p. 8

Related papers

Loading 2610.36168v1…